Техническая информация
Вредоносные функции:
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsn2.tmp\InetLoad.dll
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\Math.dll
Удаляет следующие файлы:
- %TEMP%\nsn2.tmp\NSISdl.dll
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\nsn2.tmp\InetLoad.dll
- %TEMP%\nsn2.tmp\Math.dll
Сетевая активность:
Подключается к:
- 'bi##.#antule.net':5735
- 'cv#.#antule.net':7034
UDP:
- DNS ASK bi##.#antule.net
- DNS ASK to####.kantule.net
- DNS ASK cv#.#antule.net
Другое:
Ищет следующие окна:
- ClassName: 'xsadyrqvofwuabrdvvijtxyqemoqujtte' WindowName: 'yspkxrwtlzrecnzygmzluismdrm'
- ClassName: 'ierinhmzhmohakrvo' WindowName: 'xtwecxqdhrbzqvbcsqhnfeqzxqfwfnkvyddhm'
- ClassName: 'oksigfzqghdowshpdm' WindowName: 'reisrfpugqhixgkagksvnunxsonvlxkuupc'
- ClassName: 'todibptecoltlwggx' WindowName: 'ibmutbsmqibbxgqkjlkyfwqtck'
- ClassName: 'asifhxawvauplqwhjnpqxkscgqcdbzdw' WindowName: 'uuepkctzurbepyhbs'
- ClassName: 'olcshslolvyhzvmscv' WindowName: 'ybzbelfqetunrrhingqfqgxvxwmhoemoicot'
- ClassName: 'uuhrzbpkhrxrsyhnbv' WindowName: 'rymmuwreejkpjptunvtqaxcwumy'
- ClassName: 'qxgmnmeclksfjtoxekdefenjktkfydlqsdz' WindowName: 'ohnbsanaakvsoyefimxlyzddsgiy'
- ClassName: 'csvesjippuwcrluulrasyex' WindowName: 'lbffzoqmsczqjoa'
- ClassName: 'rzhzbxdbegdrflhrhqsaohqh' WindowName: 'roosbeocohlpqfm'
- ClassName: 'oopwpkxsgsduhwnqb' WindowName: 'iykquhifzpelqmlhrfruwbaxcodiowc'
- ClassName: 'gzjsmidalsgophgcwehl' WindowName: 'vwaqojevlykwijetxbjvt'
- ClassName: 'smdpeubrhqrwkmf' WindowName: 'kuzeygampewfrswxofrmfk'
- ClassName: 'xqqzwhsmlmqiwbicljwvyvvla' WindowName: 'ydydjtievcummcmeycvrgterhb'
- ClassName: 'iaecmttiegevjrdil' WindowName: 'cccsauvrevnsddgurxwdoctegsne'
- ClassName: 'dhhaqoiesnksufsyxrkkuukelbhbajdqpqn' WindowName: 'bsdtzsaiundrwgfjtvkdbib'
- ClassName: 'gpjphyheijutqojucwaypccrijosxpfrs' WindowName: 'eqyzkbfmfwvuphtjjsfgfvivxaeezaitt'
- ClassName: 'kbabbibpndjgqhucxsaiqk' WindowName: 'tgonsboajcovzajnukkxvjaekxjnzcorn'
- ClassName: 'jylglzcndwllskozmmtrdulunsqhoxxvlpac' WindowName: 'hhubeofkfzfegjwy'
- ClassName: 'uhzxirlrthycecikaeiicrsvt' WindowName: 'jhekhlinbdfizxjahomrgiaelpfsauvorol'
- ClassName: 'ieakhylhcrmbjxgcnnaxzrlsivaeb' WindowName: 'pnyfznrexwionlsnozofyjynwofwwzgyhqpwuk'
- ClassName: 'ymhgptagcokmbfnuzivayeibnko' WindowName: 'ccnepccbiliokpufiorlgnrmdcmzwcknywdsqu'
- ClassName: 'rxrzphabqbeuzstkdwhcwjiojdkwzfd' WindowName: 'ggijyllsnwivkwcawvskwruojid'
- ClassName: 'sqsvnmphriksdxpyuwaxkxsvjcwgrysvrkkjbd' WindowName: 'xyayuaharkwbdseeuxduhbqwrtduzt'
- ClassName: 'isigytnkukmiohxithfvngwuytfdxcxwfmgxao' WindowName: 'kbkkjptbmyyizfoapldx'
- ClassName: 'ivndyzsocrgbtnwtdudgjfbwv' WindowName: 'kxsxfbrmmnezidxmfkl'
- ClassName: 'vfilrjnwlfcoediyznimysf' WindowName: 'dpukqbqiaibjifamdhqsorzrqntprr'
- ClassName: 'arqpzztglypicfysmqbdggnhgbdokhur' WindowName: 'gnkieqhbmmatzddkeppbuvyofvcoukpblidkwy'
- ClassName: 'bixfklaszytolgfedwrozrrpdvjyhudntg' WindowName: 'iujweudsbtiklez'
- ClassName: 'yretmidepianfulvlttsqtodg' WindowName: 'goishuozxoacdcagcnrtzulzzcctivpmj'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'vmmmnboaotvigmvrbwcixegsonkrm' WindowName: 'otyzcvaizqfloiybaghybjxybvfaujfozse'
- ClassName: 'fezyhkfqqfvjrpwehxzmfwkhdudjlfxuskw' WindowName: 'fxuifxptylawusn'
- ClassName: 'noqjyckaljqjrwlobtkyjvparyolzulbvyyi' WindowName: 'cpkcnsuvsfkmvppdonaykewvlrqogygwkd'
- ClassName: 'gnoolszwzgqwxlfgiaswyhrtj' WindowName: 'vebchuljajsqpkrbdtrynmerivfscldhjhescqs'
- ClassName: 'pzeznbrdijxnfnafxcgkvdznbnsiyyyncjx' WindowName: 'ymdcgsbnsgauvpxnzohwup'
- ClassName: 'ogwvpsusivelosplpvgouhyhpikdc' WindowName: 'ccrcmlnrsndhkyenrbyeniqqpubyy'
- ClassName: 'pebbeulaetrmztrgapa' WindowName: 'wesqysxojklmhcrdlwiotnkdtsc'
- ClassName: 'nadtlpshiyqqoojqryiuffbvbhtkce' WindowName: 'kynvgmadrnwyvturbksjzxvnmhctf'
- ClassName: 'iousinvhknhlfrvrjjpqdljbmfqhylespzccon' WindowName: 'bbgmgmixhszkkxad'
